Ask Your Question

nVidia driver and bumblebee not working in fedora 21

asked 2015-01-02 17:44:43 -0500

barondem gravatar image

updated 2015-02-03 11:05:18 -0500

Hi! I installed Fedora 21 Workstation on my new Asus N56JK and altough it's fast and beatiful I've got some problems with it; I managed to solve most of them (brightness function keys, subwoofer, etc.), but I'm still having trouble with the discrete nVidia GPU (which is a Maxwell-based GTX 850m) management under Fedora; I followed the Fedora wiki Bumblebee's guide, but, like other people reported time ago, there are a bit of complications the wiki guide doesn't deal with, related to Fedora's UEFI implementation; in particular, I initially got errors like these ones:

ERROR: The kernel module failed to load, because it was not signed by a key that is trusted by the kernel. Please try installing the driver again, and sign the kernel module when prompted to do so.

ERROR: Unable to load the kernel module 'nvidia.ko'. This happens most frequently when this kernel module was built against the wrong or improperly configured kernel sources, with a version of gcc that differs from the one used to build the target kernel, or if a driver such as rivafb, nvidiafb, or nouveau is present and prevents the NVIDIA kernel module from obtaining ownership of the NVIDIA graphics device(s), or no NVIDIA GPU installed in this system is supported by this NVIDIA Linux graphics driver release.

I tried to apply the solutions proposed in other older questions related to fedora 20 but they didn't work (I tried to edit the bumblebee-nvidia script but I just got the effect of nvidia module not being loaded at boot and still causing the missing key error if loaded manually and I tried to disable key checking but I didn't manage to make nvidia driver work and I also got at every boot a shim screen before Fedora boot related to key management).

Is there a clean and "official" way to solve this annoyance? Or at least a still working way to use bumblebee with nouveau driver?

Thanks in advance!

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2015-01-04 14:16:19 -0500

TForsman gravatar image

The problem is that you have a UEFI firmware and you are booting linux in a mode where the kernel requires that each kernel module that is loaded be cryptographicaly signed. When you use bumblebee-nvidia to compile the nvidia kernel driver it does it in --quiet mode, which prevents the nvidia kernel module compile script from prompting you to sign the kernel module.

Here is a dirty hack that I used to get it working on my system.

1) As root, open the script /usr/sbin/bumblebee-nvidia in your favorite editor

2) Find the line where it calls nvidia-installer -- there will be two instances, edit the --quiet out of the one that comes after the else (the non-debug line). Also remove the > redirect and everything that comes after it on the line.

3) As root, run bumblebee-nvidia. This will compile the driver. With the modified script, you will see the TUI nvidia compiler script prompts. When prompted to sign the kernel module, elect to do so. Also elect to save the .der key file. You can let it delete the private key. Towards the end it may complan about not being able to load the kernel module yet. This is fine. I also got a few errors about some libraries being write protected. This is also fine.

4) Now that the kernel module has been built and the .der public key file created, you must install the signature in your firmware. Use the mokutil utility to install the .der keyfile that was created. The key file will be located in /usr/share/nvidia and called something like nvidia-modsign-crt-XXXXXXXX.der, where XXXXXXXX is a hex code that is unique. Run mokutil like this, as root

mokutil --import /usr/share/nvidia/nvidia-modsign-crt-XXXXXXXX.der

where you replace the XXXXXXXX with the numbers and letters that actually appear in your .der file (tab complete is your friend). You can choose any password you like here. You only have to remember it for a little while.

5) Reboot. On boot your firmware should allow you to activate the new key. I had to press a key, then select something from a menu (I forget, but it seemed obvious) then enter the password I set in step 4. Then let the system boot normally.

6) Viola! The nvidia.ko module is loaded, and the bumblebee deamon is able to run.

Now, this isn't great, because next time you update your kernel you'll have to do this again. Also, if the bumblebee package gets updated (or you want a new nvidia driver) you will have to do this again. It should really be automated, but I'm not sure what the best method of doing that is.

If you have a laptop where you can turn off secureboot, then that may be prefereable. It's not always possible though.

Grabbed this text from another ask question, probably same issue.

edit flag offensive delete link more


Thank you, I had already found this answer, but it didn't work first; now I made some progress by playing with other stuff; now both nvidia and bbswitch are loaded, but optirun still doesn't work; the XOrg.8.log is this: link text how can I fix this?

barondem gravatar imagebarondem ( 2015-01-04 18:25:23 -0500 )edit

Last update of bumblebee seems to have solved almost all issues regarding selinux (error messages regarding xorg, glx, etc.), while for uefi implementation I still have to execute some steps manually: after every kernel or bumblebee update I still have to sign nvidia and bbswitch modules with my own keys (after having inserted them into trusted keys list through shim only the first time) if I want to keep uefi and secure boot on.

barondem gravatar imagebarondem ( 2015-02-18 11:46:20 -0500 )edit

Update: In my case it was --silent instead of --quiet. However it still cannot load the kernel driver

Fahad Alduraibi gravatar imageFahad Alduraibi ( 2015-09-15 08:55:40 -0500 )edit

I generated my own keys and passed them to the nvidia-installer with these two parameters --module-signing-secret-key--module-signing-public-key (btw, i am on Fedora 22 and using nvidia driver ver. 352.21)

Fahad Alduraibi gravatar imageFahad Alduraibi ( 2015-09-15 11:46:56 -0500 )edit

Instead of removing --silent I added the two parameters I mentioned in my previous comment with a absolute path to the signing keys. Now it can automatically compile and sign the driver for the new kernel. However, you will still need to sign bbswitch but that can be easily scripted under post kernel install folder.

Fahad Alduraibi gravatar imageFahad Alduraibi ( 2015-09-15 14:41:34 -0500 )edit

Question Tools

1 follower


Asked: 2015-01-02 17:44:43 -0500

Seen: 4,979 times

Last updated: Feb 03 '15